CVE-2026-116819

EUVD-2026-110526
OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain plaintext integration secrets because the notification.rules query skips redactIntegration. Attackers can call the notification.rules tRPC query to retrieve Slack bot tokens, webhook URLs, and authorization headers for use against external systems.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.5 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 22.9%
Common Weakness Enumeration
References
https://github.com/Openpanel-dev/openpanel/commit/071c736c4539c005ac32647f2cfc6dec89cfb596
https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-wfrw-rm3f-52x8
https://www.vulncheck.com/advisories/openpanel-before-3.0.0-credential-disclosure-via-notification-rules-query